Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Congress, at Last Minute, Drops Requirement to Obtain Warrant to Monitor Email

allgov.com

Post reply on HN
Print view View original

21–30 of 199 posts

Re: Congress, at Last Minute, Drops Requirement to Obtain Warrant to Monitor Email

#21

Post by raganwald »

rsync wrote: post #9

If you don't host your own mail server, you are a clown-person. Joe 6 pack has an excuse, but nobody here does.

If you don't host your own mail server, you are a clown-person

Where can I get a pair of size 47 shoes, a banana-yellow suit, and a lime-green wig? I am a programmer, not an IT administrator. I know nothing about which patches are required to keep a server secure, nor should Ihave to.

Being familiar with the technology for making programs has the same relationship to maintaing a publicly facing server as being familiar with the technology for making buildings has with operating a property-management, real-estate leasing, and property security firm all in one.

It's great that you and many others have these skills, it's not a dichotomy, but they are loosely related.

Re: Congress, at Last Minute, Drops Requirement to Obtain Warrant to Monitor Email

#22

Post by napoleond »

dmix wrote: post #16

Another reason we need better encryption solutions for email. Are there any useful options that encrypt email?

My company is working on this: http://parley.co

EDIT: As mentioned a few times elsewhere on this thread, the biggest barrier to encrypted email adoption is the network effect, ie. both ends need to be using it. That is the core problem we're trying to solve--making an email system that would be better than the rest even if it weren't encrypted, but that's the icing on the cake.

Re: Congress, at Last Minute, Drops Requirement to Obtain Warrant to Monitor Email

#23

Post by ldh »

ghayes wrote: post #15
dsplittgerber wrote: post #10

Earlier quoted context omitted.

How can I, as a somewhat proficient non-techie, accomplish that without having to dedicate a 24/7 *nix box from home? Please, if anyone knows a simple, yet elegant solution, I'm all ears.

An alternative to postfix: To receive mail, you could setup Haraka (a very simple NodeJS smtp server)[1] on any unix instance (such as AWS micro). You'll need to set proper MX records for your domain and a few simple configurations. If Heroku would let you specify a port (specifically, 25), you would be able to host on Heroku's free plan. This may put you back at odds by hosting your data on AWS (third-party). Also,…

I don't think that addresses the issue of needing a dedicated box to store your email; i.e. you still need that POP server.

Re: Congress, at Last Minute, Drops Requirement to Obtain Warrant to Monitor Email

#24

Post by w1ntermute »

mikeash wrote: post #18
woah wrote: post #3

Earlier quoted context omitted.

There is nothing about monitoring our email that is necessary for security. The war on terror is a giant hoax, more people are killed every year choking on peanut butter. Members of the government are always reaching for more and more control over our lives and power to watch us.

Do you have a cite for the peanut butter thing? I'd love to use that figure, but would hate to be unable to back it up if asked.

Another good one is the number of people that die in car accidents in the US every year, largely due to human error - 32,367 people in 2011.

If the government took one tenth of the money it spends on defense every year (which was $1.030–$1.415 trillion for 2012), or approximately $100 billion dollars, and invested it in driverless car research and the infrastructure changes necessary for it, a much bigger benefit could be wrought. But that won't happen, because it's the lobbying of the military-industrial complex that determines where money is spent.

Re: Congress, at Last Minute, Drops Requirement to Obtain Warrant to Monitor Email

#25

Post by derwiki »

ams6110 wrote: post #14
dsplittgerber wrote: post #10

Earlier quoted context omitted.

How can I, as a somewhat proficient non-techie, accomplish that without having to dedicate a 24/7 *nix box from home? Please, if anyone knows a simple, yet elegant solution, I'm all ears.

You could use a local email program and set it to download then purge your mail from the server. That way it's not in their possession for more than 180 days. But you are then responsible for your own backups etc.

... assuming that when you delete it, they delete it -- which I wouldn't assume.

Re: Congress, at Last Minute, Drops Requirement to Obtain Warrant to Monitor Email

#26

Post by kawsper »

ghayes wrote: post #15
dsplittgerber wrote: post #10

Earlier quoted context omitted.

How can I, as a somewhat proficient non-techie, accomplish that without having to dedicate a 24/7 *nix box from home? Please, if anyone knows a simple, yet elegant solution, I'm all ears.

An alternative to postfix: To receive mail, you could setup Haraka (a very simple NodeJS smtp server)[1] on any unix instance (such as AWS micro). You'll need to set proper MX records for your domain and a few simple configurations. If Heroku would let you specify a port (specifically, 25), you would be able to host on Heroku's free plan. This may put you back at odds by hosting your data on AWS (third-party). Also,…

Wouldn't they be able to access cloud systems such as AWS, Linode or Heroku as long as it hosts e-mail systems?

Re: Congress, at Last Minute, Drops Requirement to Obtain Warrant to Monitor Email

#27

Post by Entr0p »

JshWright wrote: post #7
Entr0p wrote: post #4

whelp, that passing will end my use of free text email.

This is an article about an amendment proposed to a law that's already on the books. The 180 days thing is already the law of the land, this amendment sought to change that. There's now nothing in this bill relating to mail privacy (i.e. the existing law isn't being changed at all). So, if that's the way you feel about it, the time to stop using free text email was 1986, when ECPA was first passed.

interesting, I'll have to read more - I was expecting that a warrant was required under current law to use intercepted emails

Re: Congress, at Last Minute, Drops Requirement to Obtain Warrant to Monitor Email

#28

Post by antidoh »

kawsper wrote: post #26
ghayes wrote: post #15

Earlier quoted context omitted.

An alternative to postfix: To receive mail, you could setup Haraka (a very simple NodeJS smtp server)[1] on any unix instance (such as AWS micro). You'll need to set proper MX records for your domain and a few simple configurations. If Heroku would let you specify a port (specifically, 25), you would be able to host on Heroku's free plan. This may put you back at odds by hosting your data on AWS (third-party). Also,…

Wouldn't they be able to access cloud systems such as AWS, Linode or Heroku as long as it hosts e-mail systems?

That's going to be an interesting question. If you host on linode or google apps or pair.com, is that a server under your control, or a third party.

I would call it a server under your control, the same as a store in a strip mall is under your control, not the mall owner.

But which way does anyone think that's going to go? Not the right way is my assumption.

However, if all your data is encrypted once it rests on the box, you'll at least know you're being probed when they subpoena your keys.

Re: Congress, at Last Minute, Drops Requirement to Obtain Warrant to Monitor Email

#29

Post by stephengillie »

rayiner wrote: post #6
ghayes wrote: post #2

I wish we would treat cyberspace analogues of established property with the same respect given to the original. For example, your e-mail inbox is the online equivalent of your mailbox. Yet, one being "on your lawn" and the other "at Google's data-center," all bets are off. While I believe the Supreme Court should do better job at explicitly addressing this (for instance, "responsible expectation of privacy" establish…

So the rights with respect to your mailbox derive from the fact that the Post Office was historically an appendage of the government. Giving your personal information to a government-run Post Office versus giving it to a third party like Google (that mines your personal information for advertisements!) is a salient distinction.

My question still is: why can't a judge subpoena all mail you have within the Post Office's sorting system?

Don't say it's due to prohibitive expense unless you can prove this would be more expensive than Carpathia hosting Megaupload for free.

Re: Congress, at Last Minute, Drops Requirement to Obtain Warrant to Monitor Email

#30

Post by shawn-butler »

ghayes wrote: post #2

I wish we would treat cyberspace analogues of established property with the same respect given to the original. For example, your e-mail inbox is the online equivalent of your mailbox. Yet, one being "on your lawn" and the other "at Google's data-center," all bets are off. While I believe the Supreme Court should do better job at explicitly addressing this (for instance, "responsible expectation of privacy" establish…

The Sixth Disctrict court of appeals did address this directly in US v Warshak [0]. What this scare article does a good job of is confusing the reader.

Unopened email left on a 3rd party server for longer than 180 days was considered discarded or abandoned property. Discarded physical property has never retained a reasonable expectation of privacy (for instance, the police are free to dumpster dive once your property is considered discarded). Similarly when you vacate an apartment and leave all your belongings behind, they become the property of the landlord. These are firmly established principles of common law. The waters become more grey when you are not using the 3rd party for communication but for storage, say for emails you have read and leave on the server for 180+ days. [1]

So in this case Congress wanted to establish a new right to privacy that required a warrant on rather vague and nebulous grounds. It was dropped and so the status quo remains.

All the people here complaining apparently have no idea what the law of the land currently is? Email communications residing on a third-party server for less than 180 days that offers services to the public can not be obtained without a warrant. Notification of the issuance of a warrant could be delayed by 90 days. This does not apply to 3rd party services that do not offer services to the public. They can voluntarily disclose content at their whim.

If you believe my understanding to be flawed I welcome the opportunity to be corrected.

[0]: https://www.eff.org/deeplinks/2010/12/breaking-news-eff-vict...

[1]: http://en.wikipedia.org/wiki/Stored_Communications_Act#Overv...

Post reply on HN